Remote support with user consent: a practical guide.

In short: Tell people their computers are supported remotely, ask before you take over a screen someone is using, show who is connected the whole time, let them end the session, record only when there is a reason and say so, and keep a log of everything.

1. Why consent matters
2. Attended and unattended access
3. A good-practice checklist
4. Unattended access done responsibly
5. What to say
6. How AadeeRMM handles consent

Why consent matters

Remote support only works if people let you in. A user who has been surprised by a mouse moving on its own, or who suspects someone is watching their screen, will stop reporting problems and start working around IT. Asking first is simply good service.

It also matters legally. Data protection laws such as the UK GDPR and the EU GDPR require organisations to be open with people about how their personal data is used, and seeing someone's screen, files and messages is processing personal data. Many countries also have specific rules about monitoring employees. The exact obligations depend on where you and your clients are, so treat this guide as good practice, not legal advice, and check with a professional for your situation.

Attended and unattended access

Attended access means someone is at the computer and you are helping them: they asked for help, or you contacted them. Here the person should be asked before you see or control their screen.

Unattended access means nobody is at the computer — a server, a meeting-room PC, or a laptop you are fixing out of hours. Asking permission is not possible, so the safeguards shift to agreements in advance, clear notices if someone does sit down, and a complete log.

A good-practice checklist

1. Tell people in advance. Include remote support in the IT policy or the service agreement, and mention it when people join. Nobody should discover it during a session.
2. Ask before you take over a screen. A clear prompt — who is asking, and for what — that the person accepts or declines. If they do not answer, the session does not start.
3. Start with the lightest tool. Many problems can be solved in a chat or a voice call. Share the screen only when it helps.
4. Show who is connected, the whole time. A visible notice with the technician's name, not a small icon that is easy to miss.
5. Let the person end the session. One click, at any time, without asking the technician.
6. Record only when there is a reason, and say so. Recording can protect both sides in a dispute or help train new technicians, but the person should be told, recordings should be encrypted, and they should be deleted after a fixed period.
7. Keep an audit log. Who connected to which computer, when, for how long, and what they did — files transferred, commands run — in a log that cannot be quietly edited.
8. Protect technician accounts. Two-factor sign-in for everyone, roles that limit what each person can do, and access only to the clients they work for. A stolen technician password should not open every computer you manage.
9. Be careful with what you see. Close or minimise anything personal that is not part of the problem, do not open files you do not need, and never copy data off a computer without a reason.

Unattended access done responsibly

Servers need maintenance at night, and nobody wants to be woken to approve it. Agree in writing with each client which computers can be accessed without a prompt — usually servers, sometimes shared computers — and keep the prompt for everyone else. Even for unattended sessions, show a notice with the technician's name in case someone is at the computer, and make sure every session appears in the log the client can ask to see.

What to say

A few sentences make the difference between a helpful session and an uncomfortable one:

• “I'm going to send you a request to see your screen. You'll see a box with my name — click Allow and I'll be able to look.”
• “You can stop the session at any time with the End button.”
• “I'd like to record this session so we have a record of the fix. Is that all right?”
• “I'm finished now — I've disconnected, and the notice on your screen should have gone.”

How AadeeRMM handles consent

In AadeeRMM, the person at the computer is asked before a session starts and has 90 seconds to answer; for each customer you choose whether workstations and servers ask first, and chats and calls always need the user's consent. While someone is connected, a notice with the technician's name stays on the screen, and only the user can press its End button. Sessions can be view-only. Recording is a choice for each session, the person is told, and recordings are encrypted and deleted after the retention period (30 days by default); voice calls are never recorded. Every session, file transfer and terminal command goes into a tamper-evident audit log. See Remote support for the details.

Related

• Remote support — Screen sharing, chat, calls, files and a terminal — with the user's consent.
• RMM for MSPs — RMM and PSA for every customer: tickets, contracts, invoices and your brand.